Also the Apple enclave can store ssh keys eg using sekey, which needs your fingerprint to use.

Dedicated yubikey in each computer seems like your threat model is quite complex.

Do you leave computers in weird places? Are you getting robbed once a year? Are you a high stakes poker player or CEO of a shady company?

No I just don't like having to stop what I'm doing, get up, go into another room or my backpack, and fetch a yubikey, interrupting my focus for 30-90 seconds. I have enough trouble getting and staying focused without additional interruptions.

I have like 4 laptops and two main desktops and if I didn't have 4 yubikeys in them then this would be a multiple-times-daily occurrence. Yubikeys aren't that expensive, and I mostly use the usb-c "nano" ones which are designed to live 24/7 in a computer's port, only sticking out about 2-3mm. Sometimes I have to move them around to other temporary machines but for the most part having approximately the same number of keys and computer workstations means that this is pretty infrequent.

I even have two Davinci Resolve Studio activation dongles for this same reason, and I can't physically edit video on two different computers at once, one would do if I were willing to keep track of where it is and shuffle it around between my various machines as needed.

It's pure speed/convenience, not a response to some data threat.

My concern with physical keys is what happens if it stops working?

Then that key can no longer be used. The solution to this resulting in being permanently locked out is to have more than n+1 redundancy in hardware, and ideally meatware too.

You need two; one stowed safely and only retrieved to enroll a new service, and one to use day-to-day.

enroll a new service? we are talking about gpg smartcard usage, for ssh - not u2f 2fa.

you don't need the physical key to "enroll", you just keep a copy of its pubkey.

the idea is to generate the key in the device, so it never leave the device, therefore you cannot store it somewhere else like another device.

So, the ideia is for you to have two devices, each with its own key, the first device you use daily and the second you use store in a safe location.

if your first device in daily use stop working or is lost you use the second device you have stored to login to your systems to remove the keys from the lost device and add the keys for a new device that replace it and then store the second device back in a safe location.

I have one key permanently in a usb port of each computer, and one on my keychain as a backup (which is also used for U2F and has lightning so works with my phone for 2FA), so five in total, each with their own RSA key for ssh.

If you use GPG and YubiKey approach, you can create the keys in offline computer, store them to YubiKey, and make paper copy of the private key. Also you probably shouldn't have only single way to access the remote computer, I still intend to store password for root that I never use.

I wrote about my endeavour with this approach just few days ago [1].

[1]: https://github.com/Ciantic/thoughts/blob/master/2021/yubikey...

You should totally disable password authentication for SSH.

You are right, but you can still use password for recovery purposes even if it's not used for SSH authentication.

Most VPS provides "web console" access. It connects like terminal, like Digital Ocean's web-console that doesn't require SSH access [1].

[1]: https://www.digitalocean.com/docs/droplets/resources/console...

I'm more worried about simply losing it. I travel a lot.

Just use multiple. That's what I do.

As backup you can also use OpenPGP cards which cost much less than a yubikey. Or a cheaper Fido2 token if you use Fido2 for SSH access (I don't yet but it's coming into vogue). An OpenPGP card will cost about a tenner, you'll need a card reader to use it but for backup purposes it's perfect.

Have a higher security fallback.

Yubikey with a PIN is 2FA, isn't it?

Technically yes but when people say "yubikey 2fa" they 99.99% of the time mean U2F, which is Not This.

From Wikipedia: Universal 2nd Factor (U2F) is an open standard that strengthens and simplifies two-factor authentication (2FA) using specialized Universal Serial Bus (USB) or near-field communication (NFC) devices based on similar security technology found in smart cards.

Using Yubikey to mean U2F is like people saying "Google this term", "the image is Photoshopped", "Hoover the floor", "grab me a Kleenex", or even "take the escalator". It possible "Yubikey" could become a generic trademark, but if possible people should be wary of using brand names in this way before it 'sticks'.

Neither Photoshop, Kleenex, nor Google have lost trademark protection.

Additionally, the term Yubikey isn't likely to become synonymous with 2FA in any case. Most people don't know that yubikeys work in several different, independent modes, such as FIDO/U2F 2FA, or CCID smartcard, or Yubico OTP (those long annoying strings your yubikey types when it brushes your thigh or hand).

The CCID smartcard mode requires a pin, which is technically two factor authentication (knowledge of PIN and possession of yubikey), which is an entirely different thing than FIDO/U2F 2FA (which is what most people mean when they talk about using a yubikey for 2FA, not that "yubikey" and "2FA" are interchangeable terms).

This is further complicated by the fact that CCID smartcard mode can be used for ssh (via gpg-agent, with ssh keys inside the yubikey itself), AND, separately, OpenSSH (with other keys) can use a yubikey for U2F.